Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$36k Google App Engine RCE

sites.google.com

Post reply on HN
Print view View original

11–20 of 164 posts

Re: $36k Google App Engine RCE

#11

Post by dullgiulio »

whb07 wrote: post #10
armanini_io wrote: post #9

Earlier quoted context omitted.

Uruguay is not third world country.

Yes it is. I do not want to be that stickler but this is the charts for that term: 1st world: US, UK, West Germany, essentially western countries 2nd world: Soviets, East Germany, communist countries 3rd world: everyone who doesn’t fit the Cold War theater. Either way, a GDP per capita of $15k isn’t considered “first” at whatever category you want to assign it by. Unfortunately there are no “1st world” countries in L…

Soviets, East Germany... in 2018?

Re: $36k Google App Engine RCE

#12

Post by Blackstone4 »

whb07 wrote: post #10
armanini_io wrote: post #9

Earlier quoted context omitted.

Uruguay is not third world country.

Yes it is. I do not want to be that stickler but this is the charts for that term: 1st world: US, UK, West Germany, essentially western countries 2nd world: Soviets, East Germany, communist countries 3rd world: everyone who doesn’t fit the Cold War theater. Either way, a GDP per capita of $15k isn’t considered “first” at whatever category you want to assign it by. Unfortunately there are no “1st world” countries in L…

> I do not want to be that stickler

Really?! You do but you don't but you do want to be a stickler? ....

PS West Germany and East Germany are not separate countries. :)

Re: $36k Google App Engine RCE

#13

Post by sailfast »

This is not an inconsequential amount of cash, for sure. Especially at 18! Congrats! And a great write-up to boot. Just awesome.

All that said an honest question: why would a company like Google not pay insane amounts of money for these kinds of bug finds? What would they pay their own people to find them? Seems like RCE on App Engine should be worth 100K+ and then some on top for giggles just because they can.

Obviously having a standard policy makes sense so that your community understands what to expect but as Google, what's your operational impact if you triple / quadruple vs. market value of the exploits?

Re: $36k Google App Engine RCE

#14

Post by nso »

dullgiulio wrote: post #11
whb07 wrote: post #10

Earlier quoted context omitted.

Yes it is. I do not want to be that stickler but this is the charts for that term: 1st world: US, UK, West Germany, essentially western countries 2nd world: Soviets, East Germany, communist countries 3rd world: everyone who doesn’t fit the Cold War theater. Either way, a GDP per capita of $15k isn’t considered “first” at whatever category you want to assign it by. Unfortunately there are no “1st world” countries in L…

Soviets, East Germany... in 2018?

The terms first, second and third world were coined during the cold war, during which those countries did exist.

First world were countries allied with the US. Second world were countries allied with the USSR. Third world were neutral countries.

So Switzerland, Ireland, and Sweden are third world countries.

Re: $36k Google App Engine RCE

#16

Post by whb07 »

Blackstone4 wrote: post #12
whb07 wrote: post #10

Earlier quoted context omitted.

Yes it is. I do not want to be that stickler but this is the charts for that term: 1st world: US, UK, West Germany, essentially western countries 2nd world: Soviets, East Germany, communist countries 3rd world: everyone who doesn’t fit the Cold War theater. Either way, a GDP per capita of $15k isn’t considered “first” at whatever category you want to assign it by. Unfortunately there are no “1st world” countries in L…

> I do not want to be that stickler Really?! You do but you don't but you do want to be a stickler? .... PS West Germany and East Germany are not separate countries. :)

They were 30 years ago. The term “1st world” and “2nd world” came to existence in the second half of the 20th century.

I’m only mentioning this as people usually attribute it to only economic power.

Re: $36k Google App Engine RCE

#17

Post by throwaway66666 »

Another thing that is very admirable and bold is that he had no actual idea that he discovered a RCE vuln but went ahead and confidently contacted google.

How many would stop at "Eh I managed to fire requests to a hidden RPC service in google, but couldn't figure out how to make it do anything useful to qualify".

Put yourselves and your work/findings out there people!

Re: $36k Google App Engine RCE

#18

Post by perfmode »

whb07 wrote: post #10
armanini_io wrote: post #9

Earlier quoted context omitted.

Uruguay is not third world country.

Yes it is. I do not want to be that stickler but this is the charts for that term: 1st world: US, UK, West Germany, essentially western countries 2nd world: Soviets, East Germany, communist countries 3rd world: everyone who doesn’t fit the Cold War theater. Either way, a GDP per capita of $15k isn’t considered “first” at whatever category you want to assign it by. Unfortunately there are no “1st world” countries in L…

this isn’t the way the OP used the term. they used it to make a statement about a lack of resources.

“studying CS in 3rd world country 35k is a lot of money”

Re: $36k Google App Engine RCE

#19

Post by jacquesm »

whb07 wrote: post #10
armanini_io wrote: post #9

Earlier quoted context omitted.

Uruguay is not third world country.

Yes it is. I do not want to be that stickler but this is the charts for that term: 1st world: US, UK, West Germany, essentially western countries 2nd world: Soviets, East Germany, communist countries 3rd world: everyone who doesn’t fit the Cold War theater. Either way, a GDP per capita of $15k isn’t considered “first” at whatever category you want to assign it by. Unfortunately there are no “1st world” countries in L…

You really should read a couple of newspapers every now and then, East Germany no longer exists and most communist countries don't either.

Re: $36k Google App Engine RCE

#20

Post by puzzle »

throwaway66666 wrote: post #17

Another thing that is very admirable and bold is that he had no actual idea that he discovered a RCE vuln but went ahead and confidently contacted google. How many would stop at "Eh I managed to fire requests to a hidden RPC service in google, but couldn't figure out how to make it do anything useful to qualify". Put yourselves and your work/findings out there people!

Yes, if he had known more about Google infrastructure, he could have done some damage, both active and passive. He had access to a lot of internals. I was surprised by them at first, too, but they all make sense. On the other hand, he would have probably been caught fairly rapidly.
Post reply on HN